Analysis
- max time kernel
95s - max time network
152s - platform
android-10_x64 - resource
android-x64-20260325-en - resource tags
arch:x64arch:x86image:android-x64-20260325-enlocale:en-usos:android-10-x64system - submitted
04/10/2026, 06:23
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
gurujiclubs.apk
Resource
android-x86-arm-20260325-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
gurujiclubs.apk
Resource
android-x64-20260325-en
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
gurujiclubs.apk
Resource
android-x64-arm64-20260325-en
6 signatures
150 seconds
General
- Target gurujiclubs.apk
- Size 12.6MB
- Sample261004-g5lecsxtcw
- SHA256 03e084cbbf1841589aecdb48909d53d4e68f2887c2efc928b71aaf3d4c92e9ce
- MD5 b08e3f4f0905b5fc55b9de022aaca4ba
- SHA1 2bee3241df976c332e44ce34cfd877dc35fa6598
- SHA512 56cb83777b15f93323fb5197c3ee60d0ac3e20c4ae15d623efc73ccc543c1fcdaf15200c075baebf8f6520d148bb6c5c8e704dcbb9f2fce1a0b87485470c4390
- SSDEEP 196608:83hJ5dcbPBhOuB+P8ARhWFfMEvKb1WQWV8fYtA4J6A4Je1g/1Ar2YKaU2nRs:8RJ5CPGAC8/fk1X9dgDoYGws
- TLSH T1C6D6124AF749E95AD4F7A33649752A22521B4C368793D7C31B09723C28F76E00F4ABD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
description ioc Process Framework service call android.content.IClipboard.addPrimaryClipChangedListener com.gurujiclubs - Acquires the wake lock 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock com.gurujiclubs - Queries information about active data network 1 TTPs 1 IoCs
description ioc Process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.gurujiclubs - Queries the mobile country code (MCC) 1 TTPs 1 IoCs
description ioc Process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.gurujiclubs - Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
description ioc Process Framework service call android.app.IActivityManager.registerReceiver com.gurujiclubs - Checks CPU information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/cpuinfo com.gurujiclubs - Checks memory information 2 TTPs 1 IoCs
description ioc Process File opened for read /proc/meminfo com.gurujiclubs
Processes
-
com.gurujiclubs1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5083
Network
MITRE ATT&CK Mobile v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /data/data/com.gurujiclubs/files/PersistedInstallation3474135316042110724tmp
- Size 570B
- SHA256 e8e5aa19cfb5ad52daa4a60924063cfea50153ccc8352fa2a1923a0f76d3eff2
- MD5 898c553ac4f07a9dde45d542092fce1f
- SHA1 ffb2c4b0b8f9325ef293efafc50849fd74d0e51a
- SHA512 f0bf6f7a9402481d3b3b8b930a8b5ad6d9537c21cd9ba934d69a4c5d656a13a769c18e05c1904e572367769b710dc47884837c5f76d0364b1b42d9da8276c49d
- TLSH T122F0411993F3C722E48E4206640C7A181E22C1319A6B07697EDFC03092DBC3A65A3C84
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.gurujiclubs/files/PersistedInstallation6680596784904072911tmp
- Size 90B
- SHA256 b84401bdca8e4a47be3822448a40f7ea04cca3eb62d3d1e1f0f8854b4e5d5ffd
- MD5 235ad6117b228937e0308c9d2e855460
- SHA1 90921adaa35a277e80613f0850de3f373c4abe9f
- SHA512 535efdfa51b85050a886efb277f32724356684ad335a41397068779534cbc5f29afc6158f80db73ec346022919b7f27a3a592b5b886945654ddf0d2d2fdc31cc
- TLSH T18BB0120047B28282998FF3023C4DB2005D411480140ACF1C3B0D948002D21E88A13DD8
- MD5 SHA1 SHA512 TLSH
- Path /data/data/com.gurujiclubs/files/profileInstalled
- Size 24B
- SHA256 002be252df6c9c09530db1f2e362e993ea9fb978ec8a27613057237dad8c2e7a
- MD5 2c4d84fde7158314de024f45e75b1086
- SHA1 5b2b349be92bc8e7238b258c5e758ea672cd758f
- SHA512 6816e7a42bbc29b6df4c8795c850d249ab39adaf1751be1e921be6d55cbbc0f7f5ab98bb809f150204c035568bebd825bf232a150ab10dccdd8c97e8319caba3
- MD5 SHA1 SHA512